ce101288e495a9380dd4444a3127a234_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ce101288e495a9380dd4444a3127a234_JaffaCakes118
Size

808KB
MD5

ce101288e495a9380dd4444a3127a234
SHA1

514bdb23b447feb422a85894046bff3eb5321510
SHA256

5669b5d2f41adca56f74f526f154bb37de31d98ee1f471da87627556e87a21fe
SHA512

c09396469eafc98399360c7576bfa11367c85f7029d2b6d27fe00274488b8a50b5edb88dd9bedc223518f97e682fb633297c8480052b7302ef5ab38833d79f78
SSDEEP

24576:GQU3eUCBZ+9twIXPOMejgGT/d9xLkjs/ZfBjXa:LUQ5TRfpX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce101288e495a9380dd4444a3127a234_JaffaCakes118

Files

ce101288e495a9380dd4444a3127a234_JaffaCakes118
.exe windows:4 windows x86 arch:x86

19fb41a6855054eddaa8d2045969ea51

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAAsyncSelect
send
WSAGetLastError
socket
gethostbyname
gethostbyaddr
getsockopt
recv
connect
closesocket
WSAStartup
htons
WSACleanup
ioctlsocket
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSACancelAsyncRequest

ws2_32

WSASocketA
WSAConnect
WSARecv

ijl15

ord3
ord4
ord2

kernel32

GetStringTypeW
GetStringTypeA
CreateFileA
FlushFileBuffers
SetStdHandle
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
HeapReAlloc
VirtualAlloc
VirtualFree
GetPrivateProfileStringA
WritePrivateProfileStringA
Sleep
GetVolumeInformationA
GlobalUnlock
GlobalLock
GlobalAlloc
MultiByteToWideChar
GetDriveTypeA
HeapCreate
HeapDestroy
GetCPInfo
ReadFile
SetFilePointer
LCMapStringW
LCMapStringA
WideCharToMultiByte
GetCurrentProcess
TerminateProcess
GetProcAddress
CloseHandle
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetFullPathNameA
GetCurrentDirectoryA
HeapAlloc
HeapFree
MoveFileA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
FileTimeToLocalFileTime
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
RaiseException
CompareStringA
CreateDirectoryA
CompareStringW
FileTimeToSystemTime
FindClose
FindNextFileA
FindFirstFileA
GetLastError
DeleteFileA
WriteFile

user32

GetMessageA
TranslateMessage
PeekMessageA
DestroyWindow
ShowWindow
PostMessageA
MessageBeep
GetKeyboardLayout
GetKeyboardState
MapVirtualKeyExA
ToAsciiEx
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
UpdateWindow
SetCursor
DefWindowProcA
FlashWindow
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
MessageBoxA
PostQuitMessage
DispatchMessageA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ddraw

DirectDrawCreateEx

dsound

ord1

winmm

mmioRead
mmioClose
mmioDescend
mmioOpenA
mmioAscend
timeGetTime

dinput

DirectInputCreateA

Sections

.text
Size: 680KB - Virtual size: 679KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19fb41a6855054eddaa8d2045969ea51

Headers

File Characteristics

Imports

wsock32

ws2_32

ijl15

kernel32

user32

advapi32

ddraw

dsound

winmm

dinput

Sections

.text Size: 680KB - Virtual size: 679KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 52KB - Virtual size: 130KB

Size: 60KB - Virtual size: 57KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 680KB - Virtual size: 679KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 52KB - Virtual size: 130KB

.rsrc
Size: 4KB - Virtual size: 2KB